The vulnerability identified as CVE-2026-12168 affects the Little Orbit GameFirst Anti-Cheat driver GFAC_Sys_x64.sys. It is categorized as a CWE-123 Write-What-Where condition caused by improper validation of crafted messages sent via a Minifilter communication port. This flaw allows a local attacker to escalate privileges to SYSTEM level and execute arbitrary code in kernel mode, potentially compromising the entire system. No CVSS score or vendor remediation information is currently available. The CERT advisory linked does not provide patch or mitigation details.

Successful exploitation of this vulnerability allows a local attacker to gain SYSTEM privileges and execute arbitrary code in kernel mode, which could lead to full system compromise. This elevates the attacker's capabilities beyond normal user rights, posing a significant security risk on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious activity related to the GameFirst Anti-Cheat driver. Follow updates from Little Orbit and CERT for any forthcoming patches or mitigations.